2.0 Analysis 2.1 General Although the root cause of the spalling could not be determined, it is likely that the initial cause is one of design, application, or both. At the time of the incident, the two manufacturers of the bearings were experiencing similar types of failures, but not to the same extent, including an extreme variation in aircraft cycles before failure. Such variation does not lead to reasonable predictability of bearing failure. The bearings were also failing in various aircraft/engine combinations. Likely scenarios that could explain these failures are: The bearing is subject to temperatures of between 120C and 160C and spins at 20000rpm. It may be under-designed for the application, thereby resulting in premature failure. Oil delivery may be inadequate and oil temperature may be excessive, inducing premature wear, spalling, and fatigue. The origin of the failure on the inner race, 50to 70m in depth, indicates that lubrication is a critical factor within the application. Because of the high rpm of the PMA assembly, any instance of incorrect balancing - either initial or after maintenance - may subject the bearing to stresses beyond design tolerances. Corrosion of the bearing due to improper storage or maintenance practices may result in premature failure. However, there was no evidence to suggest that corrosion was a factor in this particular occurrence. 2.2 Airbus A340 Maintenance Manuals Radial and axial movement of the PMA drive shaft alone is not a conclusive indicator of bearing condition but, combined with scoring on the PMA rotor, is a reliable indicator of a failed PMA drive shaft bearing. Neither the AirbusA340 maintenance manual nor the fault isolation manual prescribe limits for radial or axial movement of the PMA drive shaft, or contain notations that scoring of the PMA rotor may indicate a damaged or worn drive shaft bearing. Without such information, maintenance technicians were unaware that the PMA drive shaft was faulty and dismissed the unusual score marks on the PMA rotor. This additional information would have facilitated more effective troubleshooting and probably precluded the failure of the second PMA during test, but it is unlikely that it would have prevented the in-flight incident. 2.3 Electronic Control Unit (ECU) Electrical Power Transfer Technical examination revealed that an intermittent short circuit occurred in the PMA when failure of the ball bearing caused the rotor to contact the stator. The PMA was then unable to generate reliable electrical power for the ECU. The ECU continuously monitors the PMA, and, if the PMA no longer generates the required electrical power, the ECU will switch to other aircraft electrical power sources. The switch to other electrical sources, when it occurs, is rapid, usually with no significant change in engine performance. In this incident, the ECU became stuck in an endless loop of re-acquiring and losing PMA power due to the intermittent nature of the PMA failure. With no reliable or consistent source of electrical power, the engine eventually shut itself down. Without electrical power to the ECU, engine conditions were not transmitted to the cockpit instruments or CFDS, thus leading the pilots to assess that the engine had seized. CFM subsequently identified a problem with software versionC.3.G, in the ECU, that prevented the switch-over to other sources of aircraft electrical power. The CFM document, entitled CFM56-5Fleet Highlights (publication00-01-7263-07), indicates that CFM has been aware of this deficiency since November1999. Improved ECU software logic for better transfer to aircraft power was developed in early 2000 but was not certified until November2003. The ECU software revision was identified by Airbus as a non-critical item, and non-critical ECU software revisions have taken two to three years to be implemented. The FADEC system designed for use with the Airbus A340/CFM56-5C aircraft/engine combination was certified, in part, in accordance with FAR33.28. In general, this rule is to minimize the probability that a FADEC system failure will adversely affect an otherwise serviceable engine. Specifically, the intent of FAR33.28(c) is to ensure that the FADEC provides an engine control system that is considered equivalent in safety and reliability to one based on hydromechanical technology. To accomplish this, the FADEC system must be designed and certified to degrade in a fail-safe manner. That is, the design and certification process assumes that the FADEC will fail and ensures that the resulting failure condition does not jeopardize continued safe flight and landing. In the case of a loss of PMA electrical power, the FADEC fail-safe design used in the AirbusA340/CFM56-5C aircraft/engine combination relies on ECU software to acquire aircraft electrical power and prevent an unintentional IFSD. Additionally, FAR33.28(e) requires that all FADEC software be designed and implemented to prevent errors that would result in an unacceptable loss of power or thrust. Assuming that an unintentional IFSD would be categorized as an unacceptable loss of power or thrust, then a validation of ECU software would be required as part of the certification of the FADEC system. However, as this occurrence illustrates, the failure of the ECU to acquire power from the aircraft, due to a known software deficiency, raises concerns about both the continued airworthiness of the FADEC system and the certification process that approved the AirbusA340/CFM56-5C aircraft/engine combination. Failure of the ECU to acquire other aircraft electrical power during a PMA failure has caused IFSD events in several other recent aircraft incidents. The failure of the ECU to acquire other aircraft electrical power is not isolated to the AirbusA340 or the CFM56-5Cengine. It is clear that the engine electronic controls should be capable of operation in the event of a total PMA failure; however, with latent deficiencies in the software of CFM56-5C FADEC systems, and potentially with other aircraft/engine combinations, it is likely that an engine will shut down during the loss of electrical power from the PMA. 3.0 Conclusions 3.1 Findings as to Causes and Contributing Factors As a result of radial overload stress (contact fatigue), spalling damage occurred to the balls in the inner race of the ball bearing on the drive shaft of the permanent magnet alternator (PMA) on the number1 engine, resulting in bearing failure. It is likely that oil delivery, component design or inappropriate application, or a combination of factors, led to the contact fatigue of the ball bearing balls. When the bearing failed, the PMA rotor contacted the stator and created an intermittent short-circuit in the PMA, thereby removing the required electrical power to the electronic control unit (ECU). Because of a known deficiency in the ECU software, when the ECU lost power due to the intermittent failure of the PMA, it was unable to acquire alternate electrical power from the aircraft, as it was designed to do. The number1 engine shut down spontaneously as a result of the ECU losing electrical power. 3.2 Findings as to Risk Scoring of the PMA rotor, combined with drive shaft play, is a reliable indicator of a damaged or worn drive shaft bearing. The AirbusA340 maintenance manual and the fault isolation manual do not contain information about such scoring, and, as a result, maintenance technicians dismissed the tell-tale score marks on the PMA rotor. Written procedures regarding the play of the PMA drive shaft, or notations about rotor scoring, would have provided maintenance personnel with the ability to troubleshoot more effectively and identify the failed components in a more timely manner. Failure of the second PMA during test likely would have been avoided. Software deficiencies in the ECU, identified by Airbus as non-critical items, can take two to three years to implement across the various engine programs. The software deficiency that prevented the ECU from acquiring aircraft power was not detected during the certification process, indicating that there is a risk of other software anomalies not being detected during certification. 3.3 Other Findings The roller bearing in the PMA had two different serial numbers on the inner and outer races instead of being a matched set as required by the manufacturer. 4.0 Safety Action 4.1 Action Taken CFM International (CFM) issued Service Bulletin (SB)73-0126 (published as CFM56-5CSB73-0126, dated 13November2003). The SB changes the electronic control unit (ECU) software version from C.3.G to C.3.J and ensures that ECU electrical power successfully reverts to aircraft power in the event of a complete or partial permanent magnet alternator (PMA) failure. While this SB applies only to the AirbusA340 and the CFM56-5Cengines, all CFM ECU software for the CFM56-5series will have the improved logic at the next scheduled version release. In October 2003, Airbus revised the A340 maintenance manual to include specific checks during the removal of the PMA for evidence of rotor/stator contact and radial play of the PMA drive shaft. 4.2 Action Required 4.2.1 Continuing Airworthiness SB 73-0126 will update the ECU software to ensure that electrical power will successfully revert to aircraft power. This SB applies only to the AirbusA340 aircraft, and, although CFM recommends implementation within six months, the actual timeframe for accomplishing this SB is at the discretion of the operator. Additionally, Airbus advises that it has launched similar initiatives to incorporate software updates on CFM56-5Aand-5Bengines used on its A319, A320, and A321 family of aircraft. It is anticipated that compliance for these SBs will likewise be at the discretion of the operator. As of November2004, the total number of aircraft in the Canadian civil aircraft register affected by these SBs approximated120, most of which are two-engine aircraft. Given the number of aircraft affected, the known problem with PMA bearing failures, the critical function that the ECU software provides in ensuring engine reliability, and the discretionary nature of the proposed software updates, the Board is concerned that, without regulatory intervention, this known unsafe condition will remain in service well beyond the manufacturer's recommended six-month timeframe for the implementation of SB73-0126. The Board therefore recommends that: The Direction Gnrale de l'Aviation Civile and the Federal Aviation Administration issue airworthiness directives to require the implementation of all CFM56-5series jet engine service bulletins whose purpose is to incorporate software updates designed to ensure that, in the event of a permanent magnet alternator failure, the electronic control unit will revert to aircraft power. A04-03 Assessment/Reassessment Rating: Fully Satisfactory The Department of Transport ensure the continued airworthiness of Canadian-registered aircraft fitted with the CFM56-5series engine by developing an appropriate safety assurance strategy to make certain that, in the event of a permanent magnet alternator failure, the electronic control unit will revert to aircraft power. A04-04 Assessment Rating: Fully Satisfactory Common menu bar links Fran�ais Home Contact Us Help Search canada.gc.ca REPORTS AVIATION 2002 A02P0261 Institutional links AVIATION REPORTS - 2002 - A02P0261 How This Report Is Organized This report was prepared in accordance with Transportation Safety Board (TSB) standards for investigation reports. In keeping with these standards, the report is organized into the following main parts: Part 1, Factual Information: Provides objective information that is pertinent to the understanding of the circumstances surrounding the occurrence. Part 2, Analysis: Discusses and evaluates the factual information presented in Part1 that the Board considered when formulating its conclusions and safety actions. Part 3, Conclusions: Based on the analyses of the factual information, presents three categories of findings: findings as to causes and contributing factors to the occurrence; findings that expose risks that have the potential to degrade aviation safety, but that could not be shown to have played a direct role in the occurrence; and other findings that have the potential to enhance safety, or clarify issues of unresolved ambiguity or controversy. Part 4, Safety Action: Based on the findings of the investigation, recommends safety actions required to be taken to eliminate or mitigate safety deficiencies, and records the main actions already taken or being taken by the stakeholders involved. Available Formats The report can be viewed in the following formats: Paper. On the TSB web site at http://www.tsb.gc.ca. To obtain additional copies of the report, please contact TSB Communications Division Place du Centre 200 Promenade du Portage 4th Floor Gatineau, Quebec K1A 1K8 Canada Telephone: (819) 994-3741 Fax: (819) 997-2239 E-mail: communications@bst-tsb.gc.ca Transportation Safety Board of Canada - AVIATION REPORTS - 2002 - A02P0261 Transportation Safety Board of Canada Common menu bar links Fran�ais Home Contact Us Help Search canada.gc.ca REPORTS AVIATION 2002 A02P0261 Institutional links Main Links TSB Home Proactive Disclosure Marine Pipeline Rail Air Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence AVIATION REPORTS - 2002 - A02P0261 4.3 Safety Concern The investigation revealed that full authority digital engine control (FADEC) system software anomalies may not be confined solely to the AirbusA340/CFM56-5C aircraft/engine combination. Similar in-service performance anomalies of other Airbus/CFM aircraft/engine combinations have resulted in the initiation of SB action to update the FADEC system software to prevent unintentional in-flight shutdowns (IFSDs). Further, the Boeing777/Rolls Royce Trent800 aircraft/engine combination has also experienced at least one occurrence wherein the ECU did not acquire aircraft power following a PMA failure. The categorization by CFM of an ECU software whose intended purpose is to prevent an unintentional IFSD has been deemed non-critical. The resultant two to three years span taken to implement an update designed to bring the software into compliance with its basis of certification is incompatible with Federal Aviation Regulation33.28. The Board believes that recommendations A04-03 and A04-04 above will address the safety deficiencies in the existing aircraft fleet, and notes that new engines will be incorporating the changes needed to address the specific software problems identified in this investigation. However, the Board is concerned that the current certification process, specifically as it relates to FAR33.28(e), may not be sufficiently rigorous to ensure that software deficiencies are identified and corrected prior to the software being put into general use.